The CCAC does not generally require a business to obtain an individual’s consent (or “opt-in”) before collecting or using their personal information. However, consent is required in the following situations:
Exemption from the definition of “sale”. CCAC’s broad definition of “selling” could encompass a number of ordinary information transfers in addition to the transfer of data in exchange for money. The CCAC exempts from the definition of “sale” any transfer that takes place because the “consumer uses or manages the business” to “intentionally disclose personal information” to a third party.1 In other words, if a consumer consents or commits to a transfer of information, it is not considered a “sale” under the CCPA.
Sale of information on minors. The CCPA prohibits a business from knowingly selling the personal information of a consumer “under the age of 16”, unless the consumer (in the case of persons aged 13 to 16) or the guardian (in the case of persons under the age of 16) 13) has “affirmatively authorized the sale” of personal information.2 In other words, opt-in consent is required to sell a minor’s information. Ironically, if a business were to obtain affirmative consent to transfer personal information, as noted in the previous paragraph, technically, the transfer of information might not be a “sale” at all.
Financial incentive programs. The CCPA provides that a business can only participate in a financial incentive program with a consumer if the consumer gives his “prior consent”.3
Re-solicit the ability to sell. The CCPA states that if a person opt out of selling information (for example, clicks on a “Do not sell my personal information” link), a business is not allowed to seek consent (or register ) to a future sale for “at least 12 months.”4
Re-request the possibility of sharing sensitive personal information. The ACPL amended the CCPA to provide that, by January 1, 2023, if an individual refuses to share their sensitive personal information (for example, clicks on a “Do not share my sensitive personal information” link), a company is not permitted to seek their consent (or agree to) further sharing of this information for “at least 12 months.”5
1 Cal. Civ. Code 1798.140 (advertisement) (2) (A), (B). The CACP had initially indicated that the third party recipient could not “also sell the personal information, unless such disclosure complies with the provisions of [the CCPA]. “Cal. Civ. Code 1798.140
2 Cal. Civ. Code 1798.120 (c).
3 Cal. Civ. Code 1798.125 (b) (3).
4 Cal. Civ. Code 1798.135 (c) (4).
5 Cal. Civ. Code 1798.121 (b), 135 (c) (4).
© 2021 Greenberg Traurig, LLP. All rights reserved. Revue nationale de droit, volume XI, number 22